Runtime Application Self-protection
LOW MODERATE HIGHRequirements NIST SOURCE
Implement [controls] for application self-protection at runtime.
Discussion (NIST Supplemental Guidance)
Runtime application self-protection employs runtime instrumentation to detect and block the exploitation of software vulnerabilities by taking advantage of information from the software in execution. Runtime exploit prevention differs from traditional perimeter-based protections such as guards and firewalls which can only detect and block attacks by using network information without contextual awareness. Runtime application self-protection technology can reduce the susceptibility of software to attacks by monitoring its inputs and blocking those inputs that could allow attacks. It can also help protect the runtime environment from unwanted changes and tampering. When a threat is detected, runtime application self-protection technology can prevent exploitation and take other actions (e.g., sending a warning message to the user, terminating the user's session, terminating the application, or sending an alert to organizational personnel). Runtime application self-protection solutions can be deployed in either a monitor or protection mode.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SI-7(17) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- controls to be implemented for application self-protection at runtime are defined;
- <SI-07(17)_ODP controls> are implemented for application self-protection at runtime.
Examine
[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing software and information integrity; system design documentation; system configuration settings and associated documentation; list of known vulnerabilities addressed by runtime instrumentation; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel responsible for software, firmware, and/or information integrity; organizational personnel with information security responsibilities; system/network administrators; system developer].
Test
[SELECT FROM: Software, firmware, and information integrity verification tools; mechanisms supporting and/or implementing runtime application self-protection].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SI-7(17). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and information integrity policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Software, firmware, and information integrity verification tools
- mechanisms supporting and/or implementing runtime application self-protection
Other Records
- system and information integrity procedures
- procedures addressing software and information integrity
- list of known vulnerabilities addressed by runtime instrumentation
- other relevant documents or records